hMailServer Alert Test
Testing my own hMailServer failed-login detection: eleven failed logins from a Thunderbird client raise Wazuh rules 100321 and 100322, open a LabWatch incident, and get triaged step by step.
All entries
12 entries2026-09-30T1110.001~8 min
2026-09-11DFIR~6 min
Roll the Dice: INC-2026-0038
The first round of a homelab exercise: Claude Code injects a real fault and files a ticket, and I work it blind as a live incident. One workstation cannot reach an internal web app while every other host and port is fine. The cause is a single outbound firewall rule, found by listing rules on what I knew instead of a guessed name and pinned to its port and address by a shared InstanceId.
2026-09-08Homelab~47 min
Homelab Walkthrough
A walkthrough of my eleven-system SOC homelab, from physical hosts and Active Directory to Wazuh, Velociraptor, Splunk, Sliver, and LabWatch incident response.
2026-09-02T1558~18 min
AS-REP+Kerberoasting 1
AS-REP roasting and AES Kerberoasting captured from KALI, traced through DC01 events, detected in Wazuh, inspected in Wireshark, and tested with offline cracking. Includes the Wazuh rule-tree issue that silently discarded a valid 4769 match.
2026-08-16T1219~15 min
One RMM Is IT. Two Is An Incident.
One remote-access tool on a machine is normal; every managed service provider has one. The useful question is whether a second one showed up and whether the first one put it there. Four Wazuh rules built and fired against a live workstation, a certificate check that catches a renamed cmd.exe pretending to be AnyDesk, and the vendor-list gap that made the rule miss a real campaign.
2026-08-02DFIR~6 min
Installing Velociraptor in My Homelab
The service came up on the first try, then I deleted it and rebuilt it because I could not have said what half of it was doing. Two version-pinned traps: the config generator offering to write private keys onto a network share, and the server address silently resolving to localhost.
2026-07-27T1584.002~7 min
I Broke DNS, Exploited It, Then Fixed It (Here's How)
Unauthenticated zone transfer, dynamic-update record spoofing, and WPAD credential capture against a domain controller, then the Wazuh detection and hardening that shuts each one down. A real Active Directory hostname resists spoofing where a fabricated one captures cleanly.
2026-04-24IDOR~11 min
HTB Oopsie
Web enumeration into an insecure direct object reference, an upload filter defeated for a foothold, then privilege escalation through a binary calling a command on a writable path.
2026-04-22MSSQL~7 min
HTB Archetype
Server Message Block enumeration into an exposed credential, a Microsoft SQL Server foothold via xp_cmdshell, then privilege escalation from a saved administrator password.
2026-01-10T1021.002~5 min
Attacking and Defending a Windows Network Share
A vulnerable share on a domain controller with signing disabled and overprivileged service accounts. Enumeration, relay, and credential capture, then the hardening pass that closes each path.
2026-01-09T1021.002~4 min
Creating a Vulnerable Windows Network Share
Building the target before attacking it. Share and file-system permissions, why the two layers disagree, and the misconfigurations that make a share worth attacking in the first place.
2025-12-25T1566~3 min
Installing My Own Email Server Using hMailServer
Standing up a mail server on the domain controller so phishing can be practised end to end against infrastructure I own. Mail exchange and address records, then delivery.
No entries under that topic yet.